I’m not seeing the full benefit to cloudflare and its caching as I’m not sure how best to configure the cache, page rules etc.
Approx 70% of users are not hitting the cache and being served by origin.
I have followed the page rule for magento 2 to prevent cache everything for customers with login. However there must be a better solution so it is faster for those customers with sessions.
For not logged in customers I’m finding that if I run speed tests even that sometimes can take 2 seconds for first time to byte which I would not expect when being delivered what should be cache everything, it seems to regularly hit the origin server and not cloudflare as it should.
Finally, Is there a way to cache everything including private sessions, but identify the particular parts/sections of a page to leave dynamic like hole punch with page rules? For example, mini basket block, product price section etc to not be cached with private sessions but everything else to be cached with private session?
Any advice appreciated, I’ve already followed this guide Caching Static HTML with Magento (Business and Enterprise only) · Cloudflare Support docs
Hi there,
Your main issue IMO is that you have most asset set as Dynamic:

This means they do not have specific cache settings in Cloudflare and are therefore fetched from origin in every request.
I can see you have a cache rule to bypass cache on two specific cookies and a path. If that’s the only exception, my suggestion is that you create a second rule to cache everything else.
Like this perhaps:
Since cache rules are stackable, this will make sure everything is cached except the assets already covered by the current cache rule, if the cache exception rule is placed below the cache everything rule:
See 2.
Take care.
Thank you,
My current cache rule to bypass cache for the two cookies is set up under page rules currently as per the guidance from Cloudflare.
Should I create the second rule to cache everything else under cache rules and leave the page rule as it is?
This is the current page rule:
The way the current rule looks to me is that everything should be cached and then when cookie is present it bypasses.
If the cookie is present does this mean all content requested hits the origin? Images for example?
Images are static, the only part which is dynamic is customer basket, checkout, customer account area and when private cookie triggers customer pricing.
Sorry, im trying really hard to work this out but its not clear from the documentation how to do this.
Could you maybe share your domain so we can see what is being cached and what isn’t?
I think you would see much better caching behaviour if you disabled your page rules and used Cloudflare’s default caching settings. Your site has reasonable cache-control headers, and if you set Cloudflare to Caching Level: Standard
and Browser Cache TTL: Respect existing headers
, anything but the html files should be cached.
Right now, your bypass rule is much to aggressive.
How do you currently handle any changes to make to your site? Like add a new product or change a price?
If you cache html, you’d need to manually purge the cache after every change.
Thank you, Do I remove the page rule to use the default caching and will this effect customers logging in seeing private content/baskets?
For important content or product updates I would manually purge the individual URL in cloudflare, otherwise I would let it eventually update.
What if I had no page rule and then something like this:
Cache rule 1:
The problem is your “Bypass on Cookie”.
If I open a private browser window and open any site, I mostly see cache HIT/MISS, everything works fine. But as soon as I get a Session ID cookie, it is sent on every request, meaning everything changes to BYPASS, even assets that are static.
A cookie should only bypass cache on dynamic assets, not on all.
I agree, i just don’t know how to do it. I had cache everything rule on previously and customers could see other customers accounts when logged in.
So I followed the current bypass rule from cloudflare documentation. But now it is to aggressive, at the minimum it should cache media requests always.
I will wait to hear back from @mcorreia, please could you advise?
Hi there,
The image you state is dynamic, is precisely due to your no-cache rule.
I agree with @Laudian. Your no cache on cookie rule is causing that after a user successfully logs in, the content will be served from origin from then on.
Try the rule @Laudian suggested and see if it increases hits after session.
Checking the traffic to origin by content type, this is what we see:

The biggest data transfer comes from html, so you’d benefit from a cache-all rule.
Take care.
I’m sorry @mcorreia @Laudian I think I understand but I’m so nervous to make the change on my own.
Is there a way with having a quick call with someone on screenshare to set it up?
Rule 1 for example, i go to cache rules and I can’t see which field to use to produce the rule. Rule 2 I think I can do it. Really sorry, I must be having a bad day, usually I can understand technical stuff but this is very new to me.
- Cache Rule to set Cache eligibility to
Eligible for cache
and Edge TTL to Use cache-control header if present, bypass cache if not
With the cache-control headers your website supplies, this will essentially cache anything but the html, because the html has no-cache, no-store
headers.
- Mark html as eligible. Maybe by doing something like "URI Path does not contain “.” (dot). Now, you need to add the 2nd condition for all the cookies you want to bypass. Cookie does not containt “whatever”.
For these, set Edge TTL to Ignore cache-control header and use this TTL
.
For the first rule, you can just use Hostname equals www.catering24.co.uk
- it is for all requests. Or you could just skip the rule, as that is essentially the default behaviour of the cache.
Is that currently your only Cache or Page rule?
I can see these headers:
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Cf-Cache-Status: HIT
That doesn’t make much sense, but I’ll test if I have the same behaviour.
I’m now testing this set up. 3 rules…
Rule 1:
I’ve changed it to 3 rules and tested it, that’s working for me now:
Rule 1:
Rule2:
Rule3:
You can see https://test.laudian.de/cachetest
Without cookie:
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Cf-Cache-Status: HIT
With cookie:
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Cf-Cache-Status: DYNAMIC
Sry for the wrong rules earlier.